Vulnerability Database

313,825

Total vulnerabilities in the database

CVE-2020-16251

HashiCorp Vault and Vault Enterprise versions 0.8.3 and newer, when configured with the GCP GCE auth method, may be vulnerable to authentication bypass. Fixed in 1.2.5, 1.3.8, 1.4.4, and 1.5.1.

Published: Aug 26, 2020
Updated: Nov 16, 2025
CVE: CVE-2020-16251
GHSA: GHSA-4mp7-2m29-gqxf
Severity: High
Exploit:

CVSS v3:

Severity: High
Score: 8.2
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N

CVSS v2:

Severity: High
Score: 7.5
AV:N/AC:L/Au:N/C:P/I:P/A:P

CWEs:

CWE-287

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
hashicorp / vault	0.8.3	1.2.5
hashicorp / vault	1.3.0	1.3.8
hashicorp / vault	1.4.0	1.4.4
hashicorp / vault	1.5.0	1.5.1
github.com/hashicorp/vault/vault	0.8.3	1.2.5
github.com/hashicorp/vault/vault	1.3.0	1.3.8
github.com/hashicorp/vault/vault	1.4.0	1.4.4
github.com/hashicorp/vault/vault	1.5.0	1.5.1

Deep Security Visibility Without the Complexity

SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.

No setup fees
5-min deployment
Cancel anytime

Book a Demo